With disruptors and fast-moving companies entering the financial services arena at an alarming rate, firms often find themselves struggling to adapt ageing technology systems and processes to the turbulent world of financial services compliance. While digital transformation may be the ultimate goal for firms, simply keeping up with compliance and cybersecurity risks often requires intense deliberation and expensive platform upgrades. Using advanced capabilities such a pattern identification with machine learning and natural language processing, the financial services sector is primed to take advantage of cutting-edge technology — but maintaining compliance throughout the firm may still be the most pressing challenge.
The Intersection of Compliance and Technology
Compliance is not a new problem in the world of financial services. Bank, investment firms, wealth management funds — nearly all financial services organizations are handing the confidential information and transactions of individuals and organizations at scale. While compliance reporting may have been more manual in the past, the extreme complexity of the compliance and security issues facing these firms today makes manual processes technically impossible to maintain. Shifting the responsibility for compliance, reporting and security from a process-based solution to lean more heavily on technology isn’t an easy path, but one that mitigates the overarching risk for financial services firms. There are relatively complex compliance models that have been developed through the US government with the support of agencies such as the Financial Services Sector Coordinating Council, but applying the stringent strategies and tactics outlined is often more intense than entities are able to support internally.
Each of the compliance and security requirements put in place by the various regulatory agencies have positive goals: supporting the stability of the global economy and protecting the privacy rights of consumers. However, abiding by the precise reporting and data management requirements of each entity obligates financial services firms to implement complex frameworks that are costly and time-consuming. Following are a few of the most intensive compliance regulations for the financial services sector:
FINRA
FINRA, the Financial Industry Regulatory Authority, is an independent organization that is not associated with the US government that helps investors and firms confidently participate in the market by serving as the first line of oversight for the brokerage community. The unique rules and guidelines published by FINRA are aimed at ensuring a safe and fair market, with rules and general standards that are continually being updated based on changes to the global marketplace. FINRA requirements are generally focused around complex cybersecurity themes to protect against cyber intrusions, detect compromises to digital systems and creating business continuity and breach plans.
SEC
The SEC, Securities and Exchange Commission, has issued a set of guidelines that dictates how data is stored, accessed and retrieved. This requires organizations to maintain sophisticated record-keeping with two years of transactions stored for immediate retrieval with information and transactions from the prior six years can be stored for non-immediate retrieval. With intricate audit requirements, duplication and tracking methods in place, SEC rule 17a-4 can place a burden on overworked technology departments that can be difficult to overcome without external assistance from trusted technology partners. Even with an interpretation document provided by the US government, translating these electronic storage requirements requires significant investment in time and systems.
CIS 20 (Formerly SANS 20)
Provided by the Center for Internet Security (CIS), the CIS 20 controls are a prioritized set of actions that are aimed at reducing overall cybersecurity risk and protecting your financial services organization from known cyberattack vectors. These critical security controls help “bridge the gap between high-level security framework requirements and the operational commands needed to implement them”.
SOX
First passed in 2002, the Sarbanes-Oxley Act (SOX) was established to protect individuals from the actions of business entities — increasing transparency in the financial services sector and requiring formalized checks and balances for individual entities. In today’s world, SOX compliance is aimed at limiting access to internal systems that contain confidential or financial data. Fortunately, these standards are also solid business practices that can enhance your firm’s cybersecurity risk profile and reduce threat of insider attack.
—
Understanding the evolving world of IT compliance for financial services firms is an ongoing conversation, not a one-time decision. Learn more about the compliance obstacles facing the financial services sector when you download Coretelligent’s complimentary whitepaper: “How Financial Services Firms Can Manage Compliance“. With a team that works extensively in the financial services sector, Coretelligent has years of experience and consultants based in Atlanta, Boston, New York, Philadelphia and San Francisco to help your firm manage IT compliance and security. Contact our team of dedicated professionals today by calling 855-841-5888 or via email to info@coretelligent.com to schedule your free initial consultation.
